> unless you encrypt it

And to clarify, this means encrypt it before it gets to the VPS. Just having full-disk encryption is not enough because cloud providers can dump RAM. There are tools that easily extract encryption keys from RAM.

So, really, you need to trust the cloud provider unless everything is encrypted on computers you own.